X1 carbon vs X230

[Finsh]

Hello,
i would like to know which one of the following Computer would be better/faster for Qubes os

Lenovo x1 Carbon 1gen 3460 Intel Core i7-3667U vPro 2x 2GHz 8gb Ram SSD

or:

Lenovo x230 intel Core i5 3320M 4x2,6 ghz 16gb DDR3 Ram SSD

thanks a lot

[Patrik Hagara]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Assuming you can upgrade the X1's RAM to 16 gigs, both should be
pretty good -- X1 might even run a little faster due to the better CPU
(however, it also has a higher TDP so lower battery run time is to be
expected).


Cheers,
Patrik
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJZiyIvAAoJEFwecd8DH5rlAZoP+wUNyHj7DZVMxVhGJUWtuyhc
Iily/DauLQbZju5WBIfmJJRV3NnoIaJtKjDEahaEtiY+H+Eo5kkYZbqdDv1Cf0+Q
CWPOIghc3jI2V646I3rMy8I4seHUKALj5tWnzzmQhpxjDzQe49MFQHv3xwnPInpC
MJhWwX/YijUuz5Gsk9z6u4Y3oga5ay1pC25QfnNwjRuLfGq620eBybmAdqPdb2nf
l2oAXBUew1pzg3IqEnRoCh/ciZ8qpvezBHzHdlFTIXQsCF4N/8NYiY6Yg3J/AIdW
wKGbHuYICmvtUOQt7urnriMqwN472luCPrQ4wsYuEQjvI0sydoG6wxK+Nzs5ZvxI
2jcU1prVIFoSpMUWKKcHuvgRS2YuhWqmVYpRx8wTVsEc1btF2LObdGro2ZgfwJ5N
Q4CkJs31AdyQdPZx2HVCzzxFz5Qr4p9ouJ+53Dkd28ME0Xue0WnMXl3DClTITIbq
gHdd6XRtvbEfVUE60KdpS+waONXdK+y3yOfq2FiwBHXWqWL40Q0EtEwpkCyLwygq
mXCCbfrpkaw9udN16s9IbywH6ou83Jjgz5SDCwHI7lfTinw1VejlubZnFzEM91MJ
jC1aAdk2jCtfczM8UULZliaxbPHVnarluslx93NYFWtll8mLSlbsrAfOnpvRgqWu
lNLBWp6+NyndIV8cKmyy
=xyzi
-----END PGP SIGNATURE-----

[Finsh]

unfortunately, upgrading the ram of the X1 is not possible, i have to stick with 8 gb(already looked that up, on the x1 carbon i have running qubes currently)

[Patrik Hagara]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Ah well... Then it depends on your expected usage whether 8 gig would
be sufficient -- I was able to comfortably run around 10 VMs (2 of
which had browsers open) with some memory tweaking on an 8 gig
machine, but anything beyond that was just painful. So if you need
more than that or don't want to mess with the settings too much, I'd
recommend going with the X230.

Cheers,
Patrik
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJZiyPPAAoJEFwecd8DH5rl4jUP/23yMZqW5tMF/IntXlJ6mgTH
K7fxA2RldIa0UyE69RDFrnNSHlRFkaSWgTtsOr/ejgBP0hCg+AszhoYyVd8FtRB9
ub4vRKmFM4mOtemCTVETiwVKx6vRjLQPlOP2y66Fcn4arDcMPFHEsjDjvP9h3vXq
moi839bZX+2y7Lx8dMRP8NbDhuQOVL+0tCfUpZbcPoETlAZA+SiHo5f4envR5xNx
oMNNPan/Nvv9OVawDlYeAD7uILbfE90iKF+B63FEUa+DsvT66nDYcmlJ21EA14oy
kCdQcFbbFr02C6gJeSLv8wU5Ba1ATor5XqbbOfMuKpYqQ//nyh4n+oq7IMCwGQcS
LVaxmAdm+lHOKz7M4NrDBf+7oWPJsRC+X5nychZbCGYld79qBAEjy+DBZeuv0iQw
SlT0aPBBmWN3m8TmiTj+YkMDmHprImjQLrLayi2/0SS2dRUdllUFMTv4tQoM7D8Y
wGNU1xHPCVqDTIzEzYDVvbH2Ss89JqkPzTziNGLXIJZrriaw+FIwFGCaw/ZDnAH8
/HSCbZBBoMH0Q9I1qLwalOol/HEaKwTKgFGHo+d1kskgNyVouYqK7YjKds3HHkPN
ulDZijtgurZ2rIoWRDAUn3uB01xqmGj3TRoqhaJj/CHje7jnhtPHKWGgqNt8F7qd
hLb2v63LwG8jDwuZQ1bl
=vLJA
-----END PGP SIGNATURE-----

[Finsh]

So the x1 carbon should be the faster one, however, only if im not using to much VMs (cant say i had this problem so far, i normally dont use more than aprox. 7-10 vms)

On one handy, i obviously would be happy not to have to transfer my qubes os to the x230, reconfigure AEM etc etc, and i want to use the faster Option.On the other hand i dont think there is a Wifi card available for my the x1 carbon without the Intel Remote Administration Funktion, is it?

Is the a posibility to make the X1 c even faster? Someone mentioned i should disable Hyper Threading Technology in the BIOS, but i cant see wy this would be an advantage?

cheers

[Patrik Hagara]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Well, more RAM could make a huge difference in performance if your
workloads are IO intensive, eg. regularly transferring huge files
between VMs (more memory available for caching data that would
otherwise have to be re-read from disk; RAM is still faster than SSDs).

Regarding the Intel Active Management Technology vulnerability [1]
(CVE-2017-5689), my understanding is that it cannot be exploited over
wireless connections (unless the OS is explicitly cooperating with the
Management Engine by forwarding all incoming traffic via the PCI
communication controller), only wired LAN can be exploited without the
OS knowing. If you're still worried about this type of attack, an USB
qube used with external USB WiFi/Ethernet adapters might be the best
option (although a bit bulky).

According to the Xen project wiki [2], disabling hyper-threading
should make no difference as the scheduler used by Qubes is HT-aware
(ie. if your system runs noticeably faster with HT disabled, it's
definitely a bug and should be reported to the Xen project).


Cheers,
Patrik


[1] https://mjg59.dreamwidth.org/48429.html
[2] https://wiki.xenproject.org/wiki/Hyperthreading

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJZiz/JAAoJEFwecd8DH5rlp1IQAJBxbS2C+ywPANYDTqYhsOic
vWeWD4b+rQSY7LduyN8b9mOwWstMLD/kZE/Dgj8vt5wbgUWkR5944KeSEDHpUewA
FEpKT3MLmfnSTCJJJrLWU3gerc9iGt+vE/9ufFnhTX/pfv2aSyGHwTR9gSRs9Iz5
835HOBpjEkSLbMN20TlZkcmlX8fd2EHCVsIJ2LcqJub6Gnkk7vOuUz+sKpjY2VIx
6xoQ9N8sfqnO49vau7cWJFopVvgdrCOJdo31zCHsPrQbiGTI65HmsEOTWent6zvj
BqnATXFDvCb1LfGvEc5v3cYEh9Xy4TwCTuaBEFLUjGavZ84hMhrTtCitecON7sDC
+dnFfJcgwe3wQ0PswX6I2qsODabCTKm/AVnEVbowlugK2z/9FUm4UCvdvue/0hpr
+WXO/3853ZUDoWZGg0BVhLZL2jnPBCNFD+zSxmr9q/unxvTlhnhL7+M15oozvPOF
B012WvSvxuCLqPYilgftKLwfNTIZ/OrBcqlRLMq9J26HBfaihxnzX+WDIl/tDtbY
mb9rEnuxq/Mvf7xgfJtl0brcZkmXKP0k+J7rsUhP4rbSj3LmIa7O+PuVrI38pZa9
o9rURWpAGj5KDCUBp1ZIJsaHXkVIN2Jt0Rx6rL8W9lzJkLPSmCrwn/0dFXhe5Tiz
v3a7onCPSCpsakr1mzht
=l15v
-----END PGP SIGNATURE-----

[Finsh]

Thanks a lot.So i think i will go for the x230... i will use the SSD for the OS and the second drive (HDD) for the data, this should be also boost perfomance right?

btw the x1c ssd is this one https://www.ebay.de/p/Intel-SSDSCMMW180A3L-ThinkPad-X1-Carbon-180gb-SSD-6-Gbps-3-3-Volts-1-Amp/1340528719

the x230 SSD is a Samsung evo 850
if that matters.

[Patrik Hagara]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

You're welcome.

Using the SSD just for Qubes OS dom0 would be a waste, I'd put
all/most of the VMs on the SSD too. However, VMs used for data storage
only (backups, video, music, photo archives and similar) could reside
on the second, rotational drive, in order to save some precious SSD spac
e.

The exact model of the SSD does not matter -- the biggest difference
in performance between HDD and SSD lies not in the raw read or write
speeds, but in the IO operations per second that it's able to service
(hugely dependent on the seek time for HDDs, while the SSDs have
instant random access and thus can deliver vastly higher IOPS).

Unless you have a lot of archive data, the 180 GB SSD should be able
to comfortably hold all your VMs. Personally, I have everything (~30
VMs) on a 240 GB SSD, most of my data is of archival nature (~110 GB)
and I still have almost 40 GB free.


Cheers,
Patrik

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJZi0acAAoJEFwecd8DH5rl8nYQAI14/5cySNevP/vIyBuUjZCs
gHS2tkhIYBfe3NI5Pj9y0nKAYCGYIOfbGOfwb+uXlN4lvo/Nw2UEp8tsb8IHHS9d
vzCtjQTCC1x+KmGf5GAlwvCwf/nfSnwcTPPT3emOIGm4DzL0Ty7RCooYYOSgbmmg
upFC6HcusoL+4hGhZbe3wIgF97zmJM9oXnRdOw6B3TAu1qtFVc1pR/X5WkJVjo/+
/qnbjOsVW9V7Nw9oFiJ3xRioDtNAvebp2bViDZ8VovZ7U10UvVjEb4+6GwcVRa+3
tPrl1DGgDUz1BcBBWOiv37q69QsRKE03O5Xx57Hj9uqJnsQSAJxMEMEkUYDTBxCS
TgLYdwYIsGAhXZ/ts+5ZjG0tUp9hEXftdokf2bUFiiH7sOdo5hGm+WVyH/bXI5ju
bJwom7Oly/hRWvfyElxxZsW7ncX2rkZBEZEMK3ArUVsFr48LtGqxfaXFh92ZpdVG
V4FAGuaDTCy3ZhJqFhhZKsskpyYE1wrNJnAj8pp1b/bSraxjqlmTwodGZDA5P/CF
ppI25kdpxUmuZiah9v1H0U0z1Y6DFkCuO5O+6cB8mnvc30W77k7bCvmgC7qFNq5M
BcknUy5CvE0vd7ilU5NCU66YM7ib90c27jjUhqBGOzL70XmB6SFSFB7fLrpBr5c2
6RN8hvHVB2OhRmsL8+5S
=9ada
-----END PGP SIGNATURE-----

[Finsh]

Yes, that was the plan, using the HDD for things like Films , SafeVault and so on :).However, i dont know yet how easy /complicated it is under qubes to specify the storage place etc of the different vms( is it done the way its done in "normal" linux with partitions-Setup and fstab?)

" If you're still worried about this type of attack, an USB
qube used with external USB WiFi/Ethernet adapters might be the best
option (although a bit bulky). "

Thats in fact my current setup.I know i should not be possible to exploit it via wireless connection, however..well the thing with paranoia is, youre always thinking in the back of your head "as far as we know." ;-D

Anyway, thanks again for answering my questions, i think i will test qubes 4.0 on the x1c.

cheers

[Patrik Hagara]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 08/09/2017 10:04 PM, Finsh wrote:
> Yes, that was the plan, using the HDD for things like Films ,
> SafeVault and so on :).However, i dont know yet how easy
> /complicated it is under qubes to specify the storage place etc of
> the different vms( is it done the way its done in "normal" linux
> with partitions-Setup and fstab?)

It's pretty straightforward in Qubes 3.2 [1], and should be even
easier in 4.0 AFAIK.

> " If you're still worried about this type of attack, an USB qube
> used with external USB WiFi/Ethernet adapters might be the best
> option (although a bit bulky). "
>
> Thats in fact my current setup.I know i should not be possible to
> exploit it via wireless connection, however..well the thing with
> paranoia is, youre always thinking in the back of your head "as far
> as we know." ;-D

Agreed. :)

> Anyway, thanks again for answering my questions, i think i will
> test qubes 4.0 on the x1c.

No problem! Be aware that the first Qubes 4.0 release candidate has a
few known issues that you'll need to fix manually before it will even
boot up (eg. the Intel integrated graphics IOMMU bug [2] comes to mind).


Cheers,
Patrik



[1] https://www.qubes-os.org/doc/secondary-storage/
[2] https://github.com/QubesOS/qubes-issues/issues/2841

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJZi/RBAAoJEFwecd8DH5rlkGIQALbBmjEZ3CKlQgG9+rcjF3Cc
rnvxxUeP61ZvT8PHnpySJYqqYRWMF5KmTAJLpQNvlb1r8bAg1+yCLWYoR0Wt6+x/
cSQUBiJG+rAetT0w9HhWD3Rcg3gfxXH1E0GGmo/x7+vafsNoObN/qkLkhAGZ4+0c
Lm/uhFgamDZA7pNeC8lWXD5GBpnrAybe9db09FjCvGdL7AQy8DwrJ5bv23bG3m5t
qGtG05yY4/40pJaeDtHo0Wwm5zYD40V7UbNPhH2NusBge2omMIk2glvfKnA7DW/O
JgkmzUniJGL1ovtbo8mRxLaijTrSmF52CqX6G6chjbGIGN5FFwcHfB2e0HMgwaUD
QPqQ/3iIgg+z1SIuEdDBYCjfVRZgUMn+9wZhR65fYW12hY1+rlBQlcmyXiL2ds3X
ik5kXbntb5dqjQmn48UZCvKcZMEXzEq1KGqKjMFt1rPwzy36/V37VFce1HvOn11K
Ql86WSmte+Z61X/s6kcKBEK257V4JxYWslShPST321G70kd4hVpMFhYK+zzmu2m/
4HVFVhQFwjS2ZBSCUAWhfZEF6uLrhCYxbjWcB9WPJy/NIO43us36ienjpdfTuLIN
loL9Tbo5eDdSiQg0fs59WwDE2cYMLCG+L06zs6VICLDNCSQjCwFfuLNqDU8d/1uA
I5JNByt5ktx8Fcp3eiHN
=v7Fp
-----END PGP SIGNATURE-----